CVE-2026-32853

CVE-2026-32853 is a heap out-of-bounds read vulnerability affecting LibVNCServer versions 0.9.15 and prior, specifically within the UltraZip encoding handler. This flaw allows a malicious VNC server to exploit improper bounds checking in the HandleUltraZipBPP() function, targeting clients using the affected libvncserver_project library. Rated 8.1 HIGH (CVSSv3.1), exploitation requires user interaction but can be performed remotely with low attack complexity, potentially leading to information disclosure or application crashes. There is currently no evidence of active exploitation, nor are public exploit modules or significant community discussion available. Organizations should update to a fixed version (commit 009008e or later) to mitigate this risk.